Le 06/06/2025 à 21:00, Ricky Tigg a écrit :
Log-file default location ignored when no file is specified for '--logfile'

---
rkhunter(8) | man-pages

-l, --logfile [file]
 "If no specific file is given, then the default will be used."
---

 I can reasonably assume that "default" implicitly refers to the LOGFILE key value that is in rkhunter.conf. Which thus matches the situation where by default rkhunter writes out a log-file.

Log-file default location

# grep ^LOGFILE /etc/rkhunter.conf
LOGFILE=/var/log/rkhunter/rkhunter.log

To reproduce

$ sudo rkhunter -X --rwo --cronjob --logfile --enable immutable

As a result a log-file is created; its location is /var/log/rkhunter.log. Then that is unexpectedly according to rkhunter(8) man-pages

---
-l, --logfile [file]
 "By default rkhunter will write out a log file. The default location of the file is 
/var/log/rkhunter.log."
---

 The LOGFILE key value being ignored, does this indicate an issue?

Hi Ricky,

The default rkhunter.conf file contains (note that all lines are comments):

#
# This option specifies the log file pathname. The file will be created if it
# does not initially exist. If the option is unset, then the program will
# display a message each time it is run saying that the default value is being
# used.
#
# The default value is '/var/log/rkhunter.log'.
#
#LOGFILE=/var/log/rkhunter.log

In this case (key not defined) the path for log file is /var/log/rkhunter.log 
(default).

Fedora changes the rkhunter.conf file and adds  the line :

LOGFILE=/var/log/rkhunter/rkhunter.log

The key is now defined and this changes the path of log file. It's no  more the 
default path.

-l and--logfile are equivalent to the LOGFILE key.
In case where the path is not given on the command line AND the key is not defined in the file, the default path (/var/log/rkhunter.log) will be used.

That's not the case in the FEDORA package.

So everything is OK and there is no issue.

Regards.
_______________________________________________
Rkhunter-users mailing list
Rkhunter-users@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/rkhunter-users

Reply via email to